Ability to view logs in Director but not start/stop jobs?

djwagner · Post by **djwagner** » Wed Jul 08, 2009 2:49 pm

Hello,

Running Datastage 8.1 Enterprise Edition on Windows 2003.

I've seen in the Administrator Client Guide that the two user roles with access to the Director Client (Operator & Super Operator) both allow jobs to be started/stopped.

We would like, for SOX reasons, the ability for certain staff members to be able to view logs in Director but not have the ability to start/stop jobs in any way.

Is there any workaround for this requirement of ours?

Thanks,
David

chulett · Post by **chulett** » Wed Jul 08, 2009 3:08 pm

You typically accomplish something like this by automating the exporting of job logs into a persistent store (say like an rdbms) and then allowing people to query that store. There's no way that I know of to allow logs to be viewed from the Director client but disallow the running of jobs.

Could be wrong, though.

ray.wurlod · Post by **ray.wurlod** » Wed Jul 08, 2009 5:01 pm

Operator role can not start most jobs. Operator role can only start "released" jobs, which almost nobody uses any more.

JRodriguez · Post by **JRodriguez** » Wed Jul 08, 2009 5:15 pm

In IIS 8.1 world you can obtain a lot of those reporting/auditing in the Web Console for any activity that has been completed in any component of the suite .....

You can customize a report or a log view that can be saved in the metadata repository and accessed only by authorized users

Please note that IBM recommended to reversed the feature that allow the tool to saved DS Job logs in the metadata repository and continue using the old way...... so for this suggestion to work we should wait until IBM fix the issue ...

chulett · Post by **chulett** » Wed Jul 08, 2009 6:30 pm

ray.wurlod wrote:Operator role can not start most jobs. Operator role can only start "released" jobs, which almost nobody uses any more.

Hmmm... I thought that was something they 'fixed' in the 8.x world. And added the Super Operator to boot. Ah well.

vmcburney · Post by **vmcburney** » Wed Jul 08, 2009 11:00 pm

You can view all the DataStage logs view Log Management in the Information Server console. I created a user with only "operational metadata user" and "metadata workbench user" rights. I can log into console and I see Home, Administration and Reporting tabs. On the Administration tabs I see Domain Management (my DataStage credentials only), Log Management - the ability to open, create and delete log views and Schedule Monitoring - the ability to see views of job schedules. You could setup a log view for example that just showed DataStage fatal errors, another that showed Warnings, another that showed both.

For DataStage log reports you add a category filter onto a log view for IIS-DSTAGE-RUN messages. To filter on a specific DataStage project you need to go into Context and enter the project name against DSProject.

There is a drawback. The interface is not as intuitive as Director. In fact I think it's woeful, you cannot set the sort order, change column orders or even change the width of columns. Filtering or finding specific jobs is difficult. The navigation between viewing a log view and changing the parameters of that log view is clunky and just plain unfriendly. You cannot view or filter on job category/folder, you cannot filter on wildcard job names etc.

djwagner · Post by **djwagner** » Thu Jul 09, 2009 7:48 am

Thanks, this is all good stuff!

With our EE 8.1, I'm finding that if DSParams is set such that RTLogging=1 & ORLogging=0, then the logs are ONLY available via Director and not via the Web Console. On the other hand, if RTLogging=0 and ORLogging=1, then the logs are only visible via the Web Console and not via Director. Is this consistent with the behavior on others' systems??? (I want to confirm that Director can only display RT Logs and that Web Console can only display operational repository logs, and that they're each mutually exclusive.)

So right now, our Test environment is set to RTLogging so that we can use the rich functionality of Director, but in Production, it is set to ORLogging so that those who view the logs cannot start/stop jobs.

In the end, I am not fond of a.) Production being different from Test in this configuration and b.) Production using the method that IBM is recommending against (operational repository logging) due to performance reasons and possibly other factors.

Any more thoughts?

chulett · Post by **chulett** » Thu Jul 09, 2009 7:58 am

Seeing as how there are two separate options for logging, I would think they are not mutually exclusive - it's just that they are typically used in that manner. So I would therefor think you could have both if you really wanted and could take the 'performance hit' that I assume that would bring.

You are correct about which tool can display what.

JRodriguez · Post by **JRodriguez** » Thu Jul 09, 2009 8:11 am

If RTLogging=1 and ORLogging=0 the logs will be available in both Director and via the Web Console. If RTLogging=0 and ORLogging=1 only via DS Director .....

In our case we have all environment set equal, RTLogging=1 ORLogging=0, so we need to see logs in Director. main reason for this is that we want to avoid the risk of losing logs.

In the past even the job ran the logs only show up long after the job ran or not show up at all. Also we experience an increase in job run times when the amount of logs was considerable in the metadata repository, so we decide not to used this functionality until Big Blue fix the issue

djwagner · Post by **djwagner** » Thu Jul 09, 2009 9:19 am

JRodriguez wrote:If RTLogging=1 and ORLogging=0 the logs will be available in both Director and via the Web Console. If RTLogging=0 and ORLogging=1 only via DS Director .....

In your second sentence, do you really mean Web Console?

Here's what's odd. Like I said, our Test environment has RTLogging=1 and ORLogging=0. But the logs are NOT visible in Web Console since we set the setting this way (I can still view old logs from when it *was* set to ORLogging). The new logs are ONLY available in Director. Maybe this is part of the problem with logs not showing up in Web Console at all? This is acting very squirrely.

JRodriguez · Post by **JRodriguez** » Thu Jul 09, 2009 9:38 am

Sorry, I wrote it backward, here is how should be:

If RTLogging=1 and ORLogging=0 the logs will be available ONLY in Director. If RTLogging=0 and ORLogging=1 in DS Director and the Web Console..... for any job that run after you put this setting in DSParam. Old logs will still be available in the Web console ..

By the way you would like to remove the old logs from the metadata repository ... that could be affecting the overall job's performance and the tool itself